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What is claimed is: 

\l . A backup/recovery system for protecting a computer 
system, said backup/recovery system is installed in said 
computer system, said computer system including an 
application layer, said application layer coupled to an 
interface and operating predetermined application programs, 
said backup/recovery system BEING CHARACTERIZED BY 

a \ detecting module, located within said computer 
system, for monitoring a predetermined message; - 
Wherein said detecting module retrieves said 
predetermined message, in order to determine whether there 
is a predetermined harmful data contained therein for 
judging said toackup/ recovery system to backup data or not, 
said interface implements a predetermined procedure 
thereafter and \said application layer involves reading said 
predetermined message. 

2 . The systeVi of claim 1 wherein said backup/ recovery 
system is coupled op a network device, said network device is 
coupled to at leasts one client device by a communications 
link. \ 

3 . The system of claim 2 wherein said network device is 
coupled to a server device . 

4. The system of clain\ 3 wherein said server device is 
capable of controlling said \client device's backup/recovery 
conduct remotely and immediate W. 
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;\^> ^ • T ^ e system of claim 2 wherein said network device 

comprises a network means, comprising one or more of the 
group Consisting of a LAN, WAN, Internet, Intranet, Extranet 
and wiraless network. 



6. T\e system of claim 2 wherein said network device 
comprises Ja communication means, comprising one or more of 
the group consisting of electronic mail, TCP/IP sockets, 
RPC, HTTP, a^d HOP. 

7. The d^ystem of claim 1 wherein said predetermined 
harmful data Comprises a file in a predetermined form, 
comprising one \or more of the group consisting of *.EXE, 
*.DOC, and *.ZIP\form. 
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8. A method \ for protecting a computer system, said 
method comprising: 

Retrieving a predetermined message to be downloaded 
to said computer system; 

Determining wiether there being a predetermined 
harmful data contained in said predetermined message; 
and; 

Backing up data Stored in said computer system at the 
time said predetermined harmful data being contained 
in said predetermined message. 



9. The method of claim 8 wherein said backup/ recovery 
system is coupled to a network device, said network device is 
coupled to at least one client device by a communications 
link. 
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0. The method of claim 9 wherein said network device is 
coupled to a server device, 



ll.\The method of claim 10 wherein said server device is 
capable o^f controlling said client device's backup/recovery 
conduct remotely and immediately. 



12 . The\ method of claim 9 wherein said network device 
comprises a network means, comprising one or more of the 
group consist dung of a LAN, WAN, Internet, Intranet, Extranet 
and wireless network . 

13 . The menhod of claim 9 wherein said network device 
comprises a communication means, comprising one or more of 
the group consisting of electronic mail, TCP/IP sockets, 
RPC, HTTP, and IIOI 

14. The method\of claim 8 wherein said predetermined 

harmful data comprises a file in a predetermined form, 

comprising one or moi\e of the group consisting of *.EXE, 
*.D0C, and *.ZIP form. 



15. A method for protecting a computer system with a 
backup/recovery system, s>aid computer system including an 
application layer, said application layer coupled to an 
interface and operating predetermined application programs, 
said method comprising: 

Installing said backup/recovery system in said 
computer system, said backup/recovery system having 
a detecting module for\ monitoring a predetermined 
message located within said computer system; 
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Letrieving said predetermined message to be 
downloaded to said computer system; 

Determining whether there being a predetermined 
harmful data contained in said predetermined 
message ; 

Backing up data stored in said computer system at 
the vtime said predetermined harmful data being 
contained in said predetermined message; 
Implementing a predetermined procedure by said 
interface; and 

Indicating said application layer read said 
predetermined message. 



16. The method of claim 15 wherein said backup/recovery 
system is coupled no a network device, said network device is 
coupled to at leas^t: one client device by a communications 
link . 



17. The method of claim 16 wherein said network device 
is coupled to a server \device . 



18 . The method of cl^im 17 wherein said server device is 
capable of controlling said client device's backup/ recovery 
conduct remotely and immediately. 



19. The method of claim\ 16 wherein said network device 
comprises a network means, comprising one or more of the 
group consisting of a LAN, WAN], Internet, Intranet, Extranet 
and wireless network. 
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^0. The method of claim 16 wherein said network devic 
comprises a communication means, comprising one or more o 
the group consisting of electronic mail, TCP/IP sockets 
RPC, HTTP\ and HOP. 



